e1g

8 ms·

1.
by e1g 5d ago
A hallmark of good architecture is adaptability to unexpected changes in requirements. Planning ahead helps with 'known unknowns', but it's impractical when building across N years in a dynamic environment - "knowing a
2.
by e1g 5d ago
Tactically, this problem is commonly known as “colored functions”[1], and the only option in JS is to have some other runtime coordinate your function execution; in JS, that solution is Effect[2] [1] https://journal.stuffwithstuf
3.
by e1g 1mo ago
“safehouse <harness>” hides and protects your filesystem from the agent CLI - it cannot read/write/delete anything outside of the current folder, no matter what Bash/code it tries (short of finding some 0-day within Mac
4.
by e1g 1mo ago
On a Mac, you can do this via OS-native Seatbelt sandboxing - you define a static text file and it locks down the process so it can't read/write anything it's not supposed to. The syntax is a bit archaic, so I built a Bash wr
5.
by e1g 2mo ago
It took me 3 months to go from “I will never use it” to “I will never not use it”. Plus it’s always fun to watch the creators of Effect get confused about which brackets to where. The syntax is archaic, luckily we don’t write syntax by ha
6.
by e1g 3mo ago
Unfortunately, no, MacOS sandboxing does not allow that type of blocking. Only broad categories like "local" vs "remote", but no selective targeting based on domain names or IPs.
7.
by e1g 3mo ago
Safehouse author here - glad you found it helpful. It didn't even occur to me to add --offline mode because my mental model is anchored in agents which often require network access. Until we add this, the easiest option is to create a
8.
by e1g 4mo ago
In JS land, this problem (streaming, resuming, recovering, multi-client, etc) has been fully solved by https://durablestreams.com - and it can be self-hosted, or managed via Cloudflare DO.
9.
by e1g 5mo ago
We actually had to revert our rollout of CF Workers because enough of our users were in Spain and couldn’t access endpoints at seemingly arbitrary times (due to the matches)
10.
by e1g 6mo ago
For jailing local agents on a Mac, I made Agent Safehouse - it works for any agent and has many sane default for developers https://agent-safehouse.dev
11.
by e1g 6mo ago
Yes, you're correct about 'no nested sandboxing'. This also applies to sandboxing an Electron app: Electron has its own built-in sandboxing via sandbox-exec, so if you're wrapping an Electron app in your own sandboxing,
12.
by e1g 6mo ago
Claude Code and Codex quickly figure out they are inside sandbox-exec environment. Maybe because they know it internally. Other agents often realize they are being blocked, and I haven't seen them go haywire yet. Big love for Pi - it w
13.
by e1g 6mo ago
SBPL is great for filesystem controls and I haven’t hit roadblocks yet. I wish it offered more controls of outbound network requests (ie filtering by domain), but I understand why not. Yes, Safehouse should work for xcodebuild workloads in
14.
by e1g 6mo ago
Thanks, Codex helped to put that together in like 20 minutes. Try feeding your agent the idea about an interactive config builder, give it the upstream URL with your condos, and see if it can whip up something for you.
15.
by e1g 6mo ago
That’s a great idea. I think I’ll restructure the entire project to be based around a collection of community managed rules, a UI generator to build a custom text file from those rules, and an LLM skill so people can evolve their policies
16.
by e1g 6mo ago
Let’s make something so popular and useful that they can’t drop it.
17.
by e1g 6mo ago
IYKYK, it’s the new Bootstrap! The alternative would be “no site”, which is still somehow worse.
18.
by e1g 6mo ago
Yes, for about a decade. But it’s available everywhere, and still works - and protects us - like brand new!
19.
by e1g 6mo ago
Fair! You don’t actually need to install anything and can just generate a text file with the security profile for sandbox-exec. You can do that online at https://agent-safehouse.dev/policy-builder.html Alternatively, you ca
20.
by e1g 6mo ago
Testing in prod! Thank you, just fixed that typo.
21.
by e1g 6mo ago
playwright-cli works out of the box, and I just merged support for agent-browser. If you end up testing out Safehouse, and have any issues, just create an issue on GitHub, and I'll check it out. Browser usage is definitely among my use
22.
by e1g 6mo ago
Thank you for your work - I have sent many of your links to my people. Your point is totally fair for evaluating security tooling. A few notes - 1. I implemented this in Bash to avoid having an opaque binary in the way. 2. All sandbox-exec
23.
by e1g 6mo ago
> An agent inside sandbox-exec still has your AWS keys, GitHub token, whatever's in the environment. That's not the case with Agent Safehouse - you can give your agent access to select ~/.dotfiles and env, but by default
24.
by e1g 6mo ago
Love the feedback - For handling global rules (like ~/.gitconfig and ~/.gitignore), I keep a local policy file that whitelists my "shared globals" paths, and I tell Safehouse to include that policy by default. I just upd
25.
by e1g 6mo ago
Claude: can escape its sandbox (there are GitHub issues about this) and, when sandboxed, still has full read access to everything on your machine (SSH keys, API keys, files, etc.) Codex: IIRC, only shell commands are sandboxed; the actual a
26.
by e1g 6mo ago
No doubt they are getting better, but even a 0.1% chance of “rm -rf” makes it a question of “when” not “if”. And we sure spin that roulette a lot these days. Safehouse makes that 0%, which is categorically different. Also, I don’t want it t
27.
by e1g 6mo ago
Correct, this is for skipping permissions (safely), but does nothing for skipping questions.
28.
by e1g 6mo ago
Pure TUI is solid - I’ve been running all my pets inside that cage for several weeks with no issues. Auto-updates work, session renewals work, config updates work etc. But lately I’ve been using agents to test via browsers, and starting hea
29.
by e1g 6mo ago
Thanks, I picked Bash because I’m scared of all Go and Rust binaries out there! Re “overlay FS” - I too wish this was possible on Macs, but the closest I got was restricting agents to be read-only outside of CWD which, after a few turns, bu
30.
by e1g 6mo ago
Roughly, yes, but more reliable (and restrictive), as Claude Code has ways to escape its sandbox. This gives more protection and guards across all CLI agnets (Amp, Pi, etc)

More ›